Bug 46689 – [v8] fast/dom/HTMLElement/class-list.html fails

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Hajime Morrita]

It's flaky on chromium buildbot.

[Erik Arvidsson]

I only managed to reproduce this on DRT (it does not happen on TestShell nor Chromium). I should try it on

The test tests the following:

assert(classList[-1] === undefined);
assert(classList[-1] === undefined);

However, the second call incorrectly triggers the indexed getter which should return null for UInt32 that are larger than the length - 1. Why this happens on the second call is a mystery to me. I haven't been able to get a debugger attached to DRT.

I would really appreciate some help from someone with some V8 binding foo.

[Kent Tamura]

Is it flaky?  It looks 100% fail.

http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&tests=class-list.html&useWebKitCanary=true

[anton muhin]

(In reply to comment #1)
> I only managed to reproduce this on DRT (it does not happen on TestShell nor Chromium). I should try it on
> 
> The test tests the following:
> 
> assert(classList[-1] === undefined);
> assert(classList[-1] === undefined);
> 
> However, the second call incorrectly triggers the indexed getter which should return null for UInt32 that are larger than the length - 1. Why this happens on the second call is a mystery to me. I haven't been able to get a debugger attached to DRT.

What is the platform?

> 
> I would really appreciate some help from someone with some V8 binding foo.

Is it the exact JS code which triggers the problem?  v8 might compile different code if the code is in a loop, for example.

If you could send a minimal test case in JS with instructions how to run it, I'll try to debug it on my box.

I'd try to see (with printf unless there will be found the way to attach a debugger) the whole stack: how v8 invokes the callback (we should go either via runtime or small compiled stub).

In any event, Erik, feel free to ping me on IM, I'd be glad to help.

[Erik Arvidsson]

Created attachment 69050 [details]
Test case

[anton muhin]

(In reply to comment #4)
> Created an attachment (id=69050) [details]
> Test case

It looks empty

[Erik Arvidsson]

This happens on all platforms according to http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=class-list.html&useWebKitCanary=true

I only managed to repro this using DRT and it works as expected on TestShell and Chromium (I'm on a Mac).

[Erik Arvidsson]

(In reply to comment #5)
> (In reply to comment #4)
> > Created an attachment (id=69050) [details] [details]
> > Test case
> 
> It looks empty

You need a build from yesterday or you'll see script errors.

However I managed to reproduce this with MediaList. I'll add another test that shows the same bug with a media list.

[Erik Arvidsson]

Created attachment 69052 [details]
Another related test

This shows that MediaList has the same indexed getter bug in DRT as DOMTokenList.

[anton muhin]

It's actually V8 issue.  The cure should be on the way: http://codereview.chromium.org/3520006/show

[anton muhin]

https://code.google.com/p/v8/source/detail?r=5553 committed to bleeding_edge, should reach Chromium ToT early next week (if everything goes smooth).

r5554--5556 brings the fix to various v8 branches and should eventually go into Chrome 7 and maybe even Chrome 6.

Erik, may you check if this fixes the issue and close the bug if it's the case?

[Erik Arvidsson]

I verified that the fix works.